The Drupal OIDC module allows authentication via the OpenID Connect protocol. A vulnerability exists where an attacker can take over any existing Drupal account (except user 1) that has not yet been linked to an OpenID Connect user by logging in with the same email address. This issue is mitigated if the OpenID Connect provider verifies the user's email address. The vulnerability affects versions prior to 2.3.1 and has been fixed in version 2.3.1.